diff --git a/nodes/core/core/20-inject.html b/nodes/core/core/20-inject.html
index 27d0a0de3..5f8750ec3 100644
--- a/nodes/core/core/20-inject.html
+++ b/nodes/core/core/20-inject.html
@@ -492,7 +492,7 @@
                         } else if (jqXHR.status == 0) {
                             RED.notify("<strong>Error</strong>: no response from server","error");
                         } else {
-                            RED.notify("<strong>Error</strong>: unexpected error: ("+jqXHR.status+")"+textStatus,"error");
+                            RED.notify("<strong>Error</strong>: unexpected error: ("+jqXHR.status+") "+textStatus,"error");
                         }
                     }
                 });
diff --git a/nodes/core/core/58-debug.html b/nodes/core/core/58-debug.html
index cceea14bc..0adf3c91e 100644
--- a/nodes/core/core/58-debug.html
+++ b/nodes/core/core/58-debug.html
@@ -103,21 +103,24 @@
             toggle: "active",
             onclick: function() {
                 var label = this.name||"debug";
-                d3.xhr("debug/"+this.id+"/"+(this.active?"enable":"disable")).post(function(err,resp) {
-                    if (err) {
-                        if (err.status == 404) {
+                $.ajax({
+                    url: "debug/"+this.id+"/"+(this.active?"enable":"disable"),
+                    type: "POST",
+                    success: function(resp, textStatus, xhr) {
+                        if (xhr.status == 200) {
+                            RED.notify("Successfully activated: "+label,"success");
+                        } else if (xhr.status == 201) {
+                            RED.notify("Successfully deactivated: "+label,"success");
+                        }
+                    },
+                    error: function(jqXHR,textStatus,errorThrown) {
+                        if (jqXHR.status == 404) {
                             RED.notify("<strong>Error</strong>: debug node not deployed","error");
-                        } else if (err.status == 0) {
+                        } else if (jqXHR.status == 0) {
                             RED.notify("<strong>Error</strong>: no response from server","error");
                         } else {
-                            RED.notify("<strong>Error</strong>: unexpected error: ("+err.status+")"+err.response,"error");
+                            RED.notify("<strong>Error</strong>: unexpected error: ("+err.status+") "+err.response,"error");
                         }
-                    } else if (resp.status == 200) {
-                        RED.notify("Successfully activated: "+label,"success");
-                    } else if (resp.status == 201) {
-                        RED.notify("Successfully deactivated: "+label,"success");
-                    } else {
-                        RED.notify("<strong>Error</strong>: unexpected response: ("+resp.status+") "+resp.response,"error");
                     }
                 });
             }
diff --git a/nodes/core/hardware/35-arduino.js b/nodes/core/hardware/35-arduino.js
index d5e4fe7b5..f0a9dbb54 100644
--- a/nodes/core/hardware/35-arduino.js
+++ b/nodes/core/hardware/35-arduino.js
@@ -150,12 +150,9 @@ module.exports = function(RED) {
     }
     RED.nodes.registerType("arduino out",DuinoNodeOut);
 
-    RED.httpAdmin.get("/arduinoports",function(req,res) {
+    RED.httpAdmin.get("/arduinoports", RED.auth.needsPermission("arduino.read"), function(req,res) {
         ArduinoFirmata.list(function (err, ports) {
-            //console.log(JSON.stringify(ports));
-            res.writeHead(200, {'Content-Type': 'text/plain'});
-            res.write(JSON.stringify(ports));
-            res.end();
+            res.json(ports);
         });
     });
 }
diff --git a/nodes/core/hardware/36-rpi-gpio.js b/nodes/core/hardware/36-rpi-gpio.js
index bba199152..ad30e1cc9 100644
--- a/nodes/core/hardware/36-rpi-gpio.js
+++ b/nodes/core/hardware/36-rpi-gpio.js
@@ -274,11 +274,11 @@ module.exports = function(RED) {
     }
     RED.nodes.registerType("rpi-mouse",PiMouseNode);
 
-    RED.httpAdmin.get('/rpi-gpio/:id',function(req,res) {
-        res.send( JSON.stringify(pitype) );
+    RED.httpAdmin.get('/rpi-gpio/:id', RED.auth.needsPermission('rpi-gpio.read'), function(req,res) {
+        res.json(pitype);
     });
 
-    RED.httpAdmin.get('/rpi-pins/:id',function(req,res) {
-        res.send( JSON.stringify(pinsInUse) );
+    RED.httpAdmin.get('/rpi-pins/:id', RED.auth.needsPermission('rpi-gpio.read'), function(req,res) {
+        res.json(pinsInUse);
     });
 }
diff --git a/nodes/core/io/25-serial.js b/nodes/core/io/25-serial.js
index 96e4aca6f..be3035513 100644
--- a/nodes/core/io/25-serial.js
+++ b/nodes/core/io/25-serial.js
@@ -299,12 +299,9 @@ module.exports = function(RED) {
         }
     }();
 
-    RED.httpAdmin.get("/serialports",function(req,res) {
+    RED.httpAdmin.get("/serialports", RED.auth.needsPermission('serial.read'), function(req,res) {
         serialp.list(function (err, ports) {
-            //console.log(JSON.stringify(ports));
-            res.writeHead(200, {'Content-Type': 'text/plain'});
-            res.write(JSON.stringify(ports));
-            res.end();
+            res.json(ports);
         });
     });
 }
diff --git a/red/nodes/credentials.js b/red/nodes/credentials.js
index 55e6d91f5..a9353a164 100644
--- a/red/nodes/credentials.js
+++ b/red/nodes/credentials.js
@@ -17,6 +17,7 @@
 var when = require("when");
 
 var log = require("../log");
+var needsPermission = require("../api/auth").needsPermission;
 
 var credentialCache = {};
 var storage = null;
@@ -27,7 +28,7 @@ var redApp = null;
  * Adds an HTTP endpoint to allow look up of credentials for a given node id.
  */
 function registerEndpoint(type) {
-    redApp.get('/credentials/' + type + '/:id', function (req, res) {
+    redApp.get('/credentials/' + type + '/:id', needsPermission(type+".read"), function (req, res) {
         // TODO: This could be a generic endpoint with the type value
         //       parameterised.
         //